CVE-2025-26702
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-26702 is an Improper Input Validation vulnerability in ZTE GoldenDB that allows Input Data Manipulation. The issue affects GoldenDB versions from 6.1.03 through 6.1.03.04 and was published on 2025-03-11. It is associated with CWE-20 and carries a CVSS v3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Exploitation requires high privileges (PR:H) and can be performed over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Attackers with privileged access can trigger the vulnerability within the unchanged scope (S:U), resulting in high impact to availability (A:H) such as denial of service, while confidentiality (C:N) and integrity (I:N) remain unaffected.
Mitigation details are available in the ZTE security bulletin at https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1820079027271819342.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Improper input validation allows privileged network attackers to manipulate input data causing application/system crash and denial of service, directly mapping to application or system exploitation for endpoint DoS.